Adopt Framework beta with contract-declared HTTP idempotency

[andrewzolotukhin]

Original request

Adopt Framework 0.0.0-beta-20261004165009 following the merge of Framework #244. Prevent duplicate server execution when the HTTP client automatically retries a request, with ordinary application calls unchanged.

What changed

• Pin all Framework dependencies to the published beta and regenerate the npm lockfile with one shared schema installation. Align Node.js 24 across development, Docker and CI; match the Framework HTTP instrumentation version.
• Declare transaction creation .idempotent() in the shared contract. Framework generates the request key, retains it across configured HTTP retries and handles batching eligibility automatically.
• Configure typed request preparation to resolve the effective budget and check current membership, archive state, create permission and tag permission before every replay. Scope keys to the verified user and effective budget.
• Remove the local replay wrapper, custom idempotency header/error schemas and transaction-specific client retry/batching adapters. Framework owns transport validation, response capture and OpenAPI replay metadata.
• Keep ordinary calls in web forms, Server Actions and Telegram, with existing scan checkpoints. The shared client middleware configuration matches main; no form or session retry state is added.
• Cover automatic retries after a completed response is lost, concurrent replay, separate calls, timeout retries, scope isolation, authorization and OpenAPI compatibility.

Reasoning

A retry of one HTTP client call must reuse that call's key and return the original server response. A separate client call receives a fresh key even if its input is identical. Contract metadata now drives this behavior, while the application retains its authorization rules.

Replay remains bounded and process-local: 24-hour retention, 1,000 entries and 65,536 bytes per response. Restarts, expiry, separate replicas and thrown failures remain outside a durable exactly-once guarantee. No database migration is introduced.

Blog post

Skipped: this is an internal HTTP transport and dependency update with no new user interaction. The earlier manual-retry article and image are removed.

Screenshots / preview evidence

PR preview. Screenshots are not applicable to the transport behavior. Preview validation checks that concurrent same-key requests return one transaction and Location, a fresh key creates another transaction, and the generated API document exposes the replay header and errors.

Validation

• Standard clean npm ci passed with the published registry packages. Dependency checks confirm all 19 installed Framework packages use the requested beta, with one shared schema installation; other package versions are unchanged.
• npm run lint, npm run typecheck, npm test (125 files / 1,961 tests), and npm run build (all seven workspace builds) passed.
• npm run test:queries:integration passed all 61 cases in UTC and America/Los_Angeles, including a lost completed response followed by an automatic retry with only one database write.
• All required GitHub checks passed for 0ce9e51: Lint and test, Deploy PR environment and Playwright e2e. Workflow run.
• Focused Playwright preview QA passed all three tests (authentication, OpenAPI and transaction replay) against the new deployment. Three concurrent requests with one key returned one transaction and Location; a fresh key created a second transaction.
• SigNoz verification passed for the API and web preview services during focused QA (2026-10-04 17:58:26–17:58:51 UTC): 395 API spans and 253 web spans, no error spans or ERROR/FATAL logs, and transaction logs with trace/span correlation. The new API container exports HTTP request metrics (counter increase 251 over the checked deployment window).
• Telegram is not deployed in PR previews; its code remains unchanged and is covered by unit tests.
• Marked ready for review after validation. The configured PR-ready notification was sent successfully (HTTP 200).